Fixes the account model deploy setup got wrong

webadmin turned out to be FTP-only and belongs to whoever uploads
customer websites, not to this pipeline. Switched to a separate
deploy account with its own home-directory paths, well away from
where the other sites live, and made the persistent website symlink
cross into webadmin's territory instead of the other way around.

aidlc-docs/features/gitea-deployment-workflow/aidlc-state.md

@@ -46,6 +46,14 @@
   procedure drafted (Q5 = B), with an explicit caveat that shared hosting is very likely IIS-based,
   so systemd-restart and atomic-symlink-switch do not carry over unchanged — treated as a starting
   brief for a future Infrastructure Design pass, not a ready-to-execute procedure
+- **Revised after user feedback (real host facts)**: `webadmin` (the Pi's FileZilla/SFTP account,
+  root `/mnt/storage1/www/`) cannot SSH in and is not the deploy account — it's the
+  `WEBSITE_WORKSPACE.md` website-author role. A **separate, dedicated** SSH-capable account now runs
+  the deploy pipeline (`PI_MAIN_USERNAME`), with deploy paths under that account's own home
+  directory rather than under `/mnt/storage1/www/html/`, so the CMS's release structure never
+  interferes with the other hosted websites. `shared/wwwroot-web` is now a cross-account symlink to
+  wherever `webadmin` uploads this customer's site, requiring a one-time shared-group permission
+  setup — documented, not automated
 - **Artifacts**: `operations/deployment/deployment-plan.md`, `deployment-instructions.md`,
   `rollback-plan.md`